Komga: [Feature Request] External authentication via OpenID Connect

Created on 19 Apr 2020 · 6Comments · Source: gotson/komga

Is your feature request related to a problem? Please describe.

I want to give access to Komga to some of my users. I use an LDAP backend with Keycloak to provide SAML/OAuth/whatever authentifications to my different services. It'd be awesome if Komga could integrate with it, too!

Describe the solution you'd like

A way to allow external authentification (via headers, SAML/OAuth or even direct LDAP is fine for me)

Describe alternatives you've considered or other apps that can do what you want

Well, I'm stuck with authentification as I can't even add basic auth (linked to LDAP), since Komga doesn't have an "anonymous mode".

Additional context

This would be nice to have also "drop-in" configs for services like Azure, Google or Github (tho advanced settings are still needed for custom self-hosted services).

Otherwise, thanks for making Komga! It's a pretty awesome software that really solve a pain.

enhancement

Source

Arno500

👍5

Most helpful comment

Using the Organizr Auth-Proxy via the header would also be a great improvement. It's is flexible because it can basically be used with any external authentication handler.

More and more services are using this authentication method including Calibre-Web, grafana, ombi, tautulli. I have highlighted Grafana's implementation as an example below which is very robust.
https://grafana.com/docs/grafana/latest/auth/auth-proxy/

thinkhead on 10 Sep 2020

👍2

All 6 comments

Komga won't get any "anonymous mode", authentication/authorization is necessary since many features already require specific rights, and coming forward more features will do so.

I thought about adding OIDC, but give OPDS only supports Basic Auth, i didn't have much incentive to change the authentication scheme.

The application is built on top of Spring Boot, so adding custom OIDC providers shouldn't be too much of a problem, and since user accounts already are email-based, that should integrate well. The authorization part would still be inside Komga.

It won't come soon though, but it might at some point :)

gotson on 20 Apr 2020

👍1

The tactic GitLab and other OIDC service providers use are "app passwords". It's pretty easy to use, and could resolve the problem you mention with OPDS (use username or email as username + a random generated password by the app, only for the app you generated). But that's another thing to implement and more time to spend.
It's still really nice to see that it's being considered!
Thanks again

Arno500 on 20 Apr 2020

Using the Organizr Auth-Proxy via the header would also be a great improvement. It's is flexible because it can basically be used with any external authentication handler.

thinkhead on 10 Sep 2020

👍2

Using the Organizr Auth-Proxy via the header would also be a great improvement. It's is flexible because it can basically be used with any external authentication handler.

More and more services are using this authentication method including Calibre-Web, grafana, ombi, tautulli. I have highlighted Grafana's implementation as an example below which is very robust.
https://grafana.com/docs/grafana/latest/auth/auth-proxy/

See #366, I think Auth proxy mostly exists because of legacy corporate environment. Delegating authentication without the ability to verify it (like in oauth2) is unsecure.

gotson on 20 Dec 2020

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.